Per https://en.wikipedia.org/wiki/Wikipedia:Security_review_RfC, it seems like the admins mostly all agree to "Length increase to 8 bytes".
Initially, we will not set a minimum password length to login (which prevents logins for accounts with shorter passwords), so users in these groups, if they have a password shorter than 8, will still be logged in, but will be prompted to change their password every time they login.
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | Bawolff | T122164 Better limitation on number of password guesses people can make | |||
| Restricted Task | |||||
| Duplicate | None | T122123 Send echo notification to user of how many failed logins there was since last successful login | |||
| Open | None | T122248 Password/login related security issues (Tracking) | |||
| Restricted Task | |||||
| Resolved | • chasemp | T121186 Implement results of enwiki Security review RfC | |||
| Resolved | • csteipp | T119100 Increase MinimalPasswordLength to 8 for several local and global groups |
steward and founder are of course global groups. (T104371)
There is a local 'steward' and 'founder' group as well, although it looks like steward has no members, and founder only has one user, predictably.
The global stewards have agreed to raise their policy as well.
per https://meta.wikimedia.org/wiki/Requests_for_comment/Password_policy_for_users_with_certain_advanced_permissions we need to do this everywhere, not just enwiki
Change 272660 had a related patch set uploaded (by CSteipp):
Password policies for advanced permission groups
Change 276518 had a related patch set uploaded (by CSteipp):
Enforce password policies on labs
Change 251678 abandoned by CSteipp:
Set password policy for enwiki sysops
Reason:
Doing I9bf79e16d61b6e7aca89cd7bd05a8ce65685a8c2 instead
Change 272660 merged by jenkins-bot:
Password policies for advanced permission groups
Change 276518 abandoned by Reedy:
Enforce password policies on labs
Reason:
Dupe of productions, config already applied on beta